Skip to content
February 2026 vulnerability: What happened?
metabase.com | blog | #vulnerability | #metabase | #postmortem | #credential-leak | #handlebars | #security-fix
Summary
Metabase postmortem: a crafted Handlebars notification template let an authenticated user extract database credentials via outbound email; fixes lock the template engine down and strip query metadata.
- Published
- Collected